Ensuring stability and robustness in highly automated vehicle (HAV) control systems is critical for guaranteeing the safety of the intended functionality (SotiF) under real-world uncertainties inside a defined operational design domain (ODD). This paper presents a formal verification framework utilizing sum-of-squares (SOS) optimization to quantify and guarantee nonlinear system stability and robust performance in the presence of parametric uncertainties and environmental disturbances. We analyze a benchmark automated lane-following use case (UC) and verify polynomial system representations of the vehicle architecture against worst-case deviations using region of attraction (RoA) and robust positive invariant (RPI) sets. Simulation-based statistical validation using high-fidelity vehicle models confirms the effectiveness of the proposed method for formal robust control certification.

Existing classification frameworks for AI and autonomous systems are being outpaced by recent advancements in AI technologies. This limits their applicability to modern intelligent systems, particularly agentic AI systems (autonomous systems that leverage foundation models to achieve wide-ranging, multi-layered goals). To address this deficiency, we introduce INSYTE, a multi-faceted framework that supports the classification of AI systems ranging from traditional rule-based systems to cutting-edge embodied AI and agentic systems. To that end, INSYTE considers the essential characteristics of an AI system across eight key dimensions grouped into four categories: system design ( underspecification and adaptiveness ); functionality ( breadth and depth ); operating environment ( diversity and dynamism ); and independence from human operational control ( intervention and oversight ). Different AI systems (or versions of systems) yield different ‘patterns’ on an eight-axis radar chart that INSYTE uses to provide an immediate visual summary of an AI system’s overall capability and a detailed representation of its individual characteristics. The INSYTE framework aligns with OECD’s definition of deployed AI systems, which is becoming the standard definition used by legislators and developers worldwide.

We study challenges using reinforcement learning in controlling energy systems, where apart from performance requirements, one has additional safety requirements such as avoiding blackouts. We detail how these safety requirements in real-time temporal logic can be strengthened via discretization into linear temporal logic (LTL), such that the satisfaction of the LTL formulae implies the satisfaction of the original safety requirements. The discretization enables advanced engineering methods such as synthesizing shields for safe reinforcement learning as well as formal verification, where for statistical model checking, the probabilistic guarantee acquired by LTL model checking forms a lower bound for the satisfaction of the original real-time safety requirements.

The need to make sense of complex input data within a vast variety of unpredictable scenarios has been a key driver for the use of machine learning (ML), for example in Automated Driving Systems (ADS). Such systems are usually safety-critical, and therefore they need to be safety assured. In order to consider the results of the safety assurance activities (scoping uncovering previously unknown hazardous scenarios), a continuous approach to arguing safety is required, whilst iteratively improving ML-specific safety-relevant properties, such as robustness and prediction certainty. Such a continuous safety life cycle will only be practical with an efficient and effective approach to analyzing the impact of system changes on the safety case. In this paper, we propose a semi-automated approach for accurately identifying the impact of changes on safety arguments. We focus on arguments that reason about the sufficiency of the data used for the development of ML components. The approach qualitatively and quantitatively analyses the impact of changes in the input space of the considered ML component on other artifacts created during the execution of the safety life cycle, such as datasets and performance requirements and makes recommendations to safety engineers for handling the identified impact. We implement the proposed approach in a model-based safety engineering environment called FASTEN, and we demonstrate its application for an ML-based pedestrian detection component of an ADS.

With ever more complicated functionalities being integrated in modern autonomous systems, traditional design methods may not remain sufficient to deliver trusted and high-performance systems with stringent temporal, safety and cost efficiency requirements. In this paper, we discuss the limitations of the traditional design methods with the above requirements enforced, in which hardware and software design are often considered separately. To tackle these limitations, this paper presents a novel design solution that synthesizes both software-level and hardware-level design. First, we highlight and analyze the interconnections between software-level methods (e.g. priority assignment and task allocation) and hardware design (e.g. cache and memory management), in terms of the resulting system performance, e.g. latency. Second, by applying the identified interconnections, we propose an optimization framework to produce high-quality synthesized solutions of both software and hardware design based on a set of candidate design methods. In addition, we describe potential research directions derived from the work and major challenges that can be investigated jointly by engineers and researchers from embedded systems, system safety and programming languages communities.

The complexity of safety-critical E/E-systems within the automotive domain are continuously increasing. At the same time, functional safety standards such as the ISO 26262 prescribe analysis methods like the Fault Tree Analysis (FTA) and Failure Mode and Effects Analysis (FMEA). Currently, these analysis methods are mainly performed manually and are often not consistent with an evolving system model.

Scenario based requirements specifications are the industry norm for defining communicating systems. These scenarios are often captured in the form of UML/MSC sequence diagrams. Errors are often introduced at this stage of the development process, which are costly to resolve if they are not detected early. This paper is concerned with the automatic detection and resolution of semantic errors that can occur in such scenarios.The paper discusses a semantic interpretation of scenario-based requirements and various types of defects (or pathologies) that can be detected. The paper defines the semantics and defects within a partial order theoretic framework. We introduce a UML 2.0 profile that captures various domain specific communication semantics, which can be used to determine the relevance of detected pathologies when different underlying implementation assumptions are made. The paper also discusses how to automatically resolve pathologies by using this profile to adapt the communication architecture in the requirements model.

We discuss issues in the development of formal methods for use in aerospace applications, reflecting our experience in working with both Rolls-Royce and British Aerospace. We discuss some of the key factors which we believe govern the application of discrete mathematics to aerospace applications, drawing comparisons with applied engineering mathematics in other domains. We give an overview of three projects (the three "small steps"): the development of a domain-specific language for aircraft engine control system specification; the development of a formal semantics and tool support for state transition systems to facilitate analysis of specifications produced by systems engineers; the use of formalism in support of test automation. We then discuss the "gap" we see between the needs of industry and the current focus of the formal methods research community by pointing out important facets of industrial applicable formal methods which are not receiving adequate attention. We refer to this as a "giant leap" due to the need for a cultural shift in the research community and the need for a coherent approach to the identified research issues rather than piecemeal studies of the issues. Our conclusions are to be optimistic for the future use of formal methods in industry albeit with concern that their potential will not be realised unless there is a shift in emphasis within the research community?.